What is the CVSS score of CVE-2019-6814?

CVE-2019-6814 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 36.6%.

Is there a public PoC exploit available for CVE-2019-6814?

Yes, a public proof-of-concept exploit is available for CVE-2019-6814. Prioritise patching immediately. EPSS: 36.6%.

Net5501 Firmware CVE-2019-6814

CRITICAL

Improper Authentication (CWE-287)

2019-05-22 cybersecurity@se.com

Authentication Bypass Net5501 Firmware Net5501 I Firmware Net5501 Xt Firmware Net5504 Firmware Net5500 Firmware Net5516 Firmware Net5508 Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 22, 2019 - 20:29 nvd

CRITICAL 9.8

DescriptionNVD

AnalysisAI

A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiality, integrity, and availability when a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiality, integrity, and availability when a remote attacker crafts a malicious request to the encoder webUI. Affected products include: Schneider-Electric Net5501 Firmware, Schneider-Electric Net5501-I Firmware, Schneider-Electric Net5501-Xt Firmware, Schneider-Electric Net5504 Firmware, Schneider-Electric Net5500 Firmware. Version information: version 2.1.9.7.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.